Skip to content

Commit 90b5413

Browse files
yim-leeyim-lee
committed
Package manifest checksum TOFU
Motivation: SwiftPM should do checksum TOFU for package manifests. Modifications: - Modify fingerprint storage structure to store fingerprint by content type - Modfiy fingerprint storage API to allow retrieving fingerprints by content type - Add API to `ChecksumTOFU` for manifests - Wire up manifest TOFU in `RegistryClient`
1 parent eec67d7 commit 90b5413

18 files changed

+2271
-421
lines changed

‎Sources/PackageFingerprint/FilePackageFingerprintStorage.swift‎

Lines changed: 280 additions & 95 deletions
Large diffs are not rendered by default.

‎Sources/PackageFingerprint/Model.swift‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
//
33
// This source file is part of the Swift open source project
44
//
5-
// Copyright (c) 2021 Apple Inc. and the Swift project authors
5+
// Copyright (c) 2021-2023 Apple Inc. and the Swift project authors
66
// Licensed under Apache License v2.0 with Runtime Library Exception
77
//
88
// See http://swift.org/LICENSE.txt for license information
@@ -12,25 +12,28 @@
1212

1313
import struct Foundation.URL
1414

15+
import PackageModel
1516
import struct TSCUtility.Version
1617

1718
public struct Fingerprint: Equatable {
1819
public let origin: Origin
1920
public let value: String
21+
public let contentType: ContentType
2022

21-
public init(origin: Origin, value: String) {
23+
public init(origin: Origin, value: String, contentType: ContentType) {
2224
self.origin = origin
2325
self.value = value
26+
self.contentType = contentType
2427
}
2528
}
2629

27-
public extension Fingerprint {
28-
enum Kind: String, Hashable {
30+
extension Fingerprint {
31+
public enum Kind: String, Hashable {
2932
case sourceControl
3033
case registry
3134
}
3235

33-
enum Origin: Equatable, CustomStringConvertible {
36+
public enum Origin: Equatable, CustomStringConvertible {
3437
case sourceControl(URL)
3538
case registry(URL)
3639

@@ -61,9 +64,25 @@ public extension Fingerprint {
6164
}
6265
}
6366
}
67+
68+
public enum ContentType: Hashable, CustomStringConvertible {
69+
case sourceCode
70+
case manifest(ToolsVersion?)
71+
72+
public var description: String {
73+
switch self {
74+
case .sourceCode:
75+
return "sourceCode"
76+
case .manifest(.none):
77+
return Manifest.filename
78+
case .manifest(.some(let toolsVersion)):
79+
return "Package@swift-\(toolsVersion).swift"
80+
}
81+
}
82+
}
6483
}
6584

66-
public typealias PackageFingerprints = [Version: [Fingerprint.Kind: Fingerprint]]
85+
public typealias PackageFingerprints = [Version: [Fingerprint.Kind: [Fingerprint.ContentType: Fingerprint]]]
6786

6887
public enum FingerprintCheckingMode: String {
6988
case strict

‎Sources/PackageFingerprint/PackageFingerprintStorage.swift‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public protocol PackageFingerprintStorage {
2222
version: Version,
2323
observabilityScope: ObservabilityScope,
2424
callbackQueue: DispatchQueue,
25-
callback: @escaping (Result<[Fingerprint.Kind: Fingerprint], Error>) -> Void
25+
callback: @escaping (Result<[Fingerprint.Kind: [Fingerprint.ContentType: Fingerprint]], Error>) -> Void
2626
)
2727

2828
func put(
@@ -39,7 +39,7 @@ public protocol PackageFingerprintStorage {
3939
version: Version,
4040
observabilityScope: ObservabilityScope,
4141
callbackQueue: DispatchQueue,
42-
callback: @escaping (Result<[Fingerprint.Kind: Fingerprint], Error>) -> Void
42+
callback: @escaping (Result<[Fingerprint.Kind: [Fingerprint.ContentType: Fingerprint]], Error>) -> Void
4343
)
4444

4545
func put(
@@ -57,6 +57,7 @@ extension PackageFingerprintStorage {
5757
package: PackageIdentity,
5858
version: Version,
5959
kind: Fingerprint.Kind,
60+
contentType: Fingerprint.ContentType,
6061
observabilityScope: ObservabilityScope,
6162
callbackQueue: DispatchQueue,
6263
callback: @escaping (Result<Fingerprint, Error>) -> Void
@@ -67,14 +68,15 @@ extension PackageFingerprintStorage {
6768
observabilityScope: observabilityScope,
6869
callbackQueue: callbackQueue
6970
) { result in
70-
self.get(kind: kind, result, callback: callback)
71+
self.get(kind: kind, contentType: contentType, result, callback: callback)
7172
}
7273
}
7374

7475
public func get(
7576
package: PackageReference,
7677
version: Version,
7778
kind: Fingerprint.Kind,
79+
contentType: Fingerprint.ContentType,
7880
observabilityScope: ObservabilityScope,
7981
callbackQueue: DispatchQueue,
8082
callback: @escaping (Result<Fingerprint, Error>) -> Void
@@ -85,17 +87,20 @@ extension PackageFingerprintStorage {
8587
observabilityScope: observabilityScope,
8688
callbackQueue: callbackQueue
8789
) { result in
88-
self.get(kind: kind, result, callback: callback)
90+
self.get(kind: kind, contentType: contentType, result, callback: callback)
8991
}
9092
}
9193

9294
private func get(
9395
kind: Fingerprint.Kind,
94-
_ fingerprintsResult: Result<[Fingerprint.Kind: Fingerprint], Error>,
96+
contentType: Fingerprint.ContentType,
97+
_ fingerprintsByKindResult: Result<[Fingerprint.Kind: [Fingerprint.ContentType: Fingerprint]], Error>,
9598
callback: @escaping (Result<Fingerprint, Error>) -> Void
9699
) {
97-
callback(fingerprintsResult.tryMap { fingerprints in
98-
guard let fingerprint = fingerprints[kind] else {
100+
callback(fingerprintsByKindResult.tryMap { fingerprintsByKind in
101+
guard let fingerprintsByContentType = fingerprintsByKind[kind],
102+
let fingerprint = fingerprintsByContentType[contentType]
103+
else {
99104
throw PackageFingerprintStorageError.notFound
100105
}
101106
return fingerprint
@@ -110,9 +115,9 @@ public enum PackageFingerprintStorageError: Error, Equatable, CustomStringConver
110115
public var description: String {
111116
switch self {
112117
case .conflict(let given, let existing):
113-
return "Fingerprint \(given) is different from previously recorded value \(existing)"
118+
return "fingerprint \(given) is different from previously recorded value \(existing)"
114119
case .notFound:
115-
return "Not found"
120+
return "not found"
116121
}
117122
}
118123
}

‎Sources/PackageRegistry/ChecksumTOFU.swift‎

Lines changed: 74 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@ struct PackageVersionChecksumTOFU {
3535
self.versionMetadataProvider = versionMetadataProvider
3636
}
3737

38-
func validate(
38+
// MARK: - source archive
39+
40+
func validateSourceArchive(
3941
registry: Registry,
4042
package: PackageIdentity.RegistryIdentity,
4143
version: Version,
@@ -62,7 +64,7 @@ struct PackageVersionChecksumTOFU {
6264
case .warn:
6365
observabilityScope
6466
.emit(
65-
warning: "The checksum \(checksum) does not match previously recorded value \(expectedChecksum)"
67+
warning: "the checksum \(checksum) for source archive of \(package) \(version) does not match previously recorded value \(expectedChecksum)"
6668
)
6769
}
6870
}
@@ -84,6 +86,7 @@ struct PackageVersionChecksumTOFU {
8486
self.readFromStorage(
8587
package: package,
8688
version: version,
89+
contentType: .sourceCode,
8790
observabilityScope: observabilityScope,
8891
callbackQueue: callbackQueue
8992
) { result in
@@ -113,6 +116,7 @@ struct PackageVersionChecksumTOFU {
113116
package: package,
114117
version: version,
115118
checksum: checksum,
119+
contentType: .sourceCode,
116120
observabilityScope: observabilityScope,
117121
callbackQueue: callbackQueue
118122
) { writeResult in
@@ -130,9 +134,69 @@ struct PackageVersionChecksumTOFU {
130134
}
131135
}
132136

137+
// MARK: - manifests
138+
139+
func validateManifest(
140+
registry: Registry,
141+
package: PackageIdentity.RegistryIdentity,
142+
version: Version,
143+
toolsVersion: ToolsVersion?,
144+
checksum: String,
145+
timeout: DispatchTimeInterval?,
146+
observabilityScope: ObservabilityScope,
147+
callbackQueue: DispatchQueue,
148+
completion: @escaping (Result<Void, Error>) -> Void
149+
) {
150+
let contentType = Fingerprint.ContentType.manifest(toolsVersion)
151+
152+
self.readFromStorage(
153+
package: package,
154+
version: version,
155+
contentType: .manifest(toolsVersion),
156+
observabilityScope: observabilityScope,
157+
callbackQueue: callbackQueue
158+
) { result in
159+
switch result {
160+
case .success(.some(let expectedChecksum)):
161+
// Previously recorded checksum
162+
do {
163+
if checksum != expectedChecksum {
164+
switch self.fingerprintCheckingMode {
165+
case .strict:
166+
throw RegistryError.invalidChecksum(expected: expectedChecksum, actual: checksum)
167+
case .warn:
168+
observabilityScope
169+
.emit(
170+
warning: "the checksum \(checksum) for \(contentType) of \(package) \(version) does not match previously recorded value \(expectedChecksum)"
171+
)
172+
}
173+
}
174+
completion(.success(()))
175+
} catch {
176+
completion(.failure(error))
177+
}
178+
default:
179+
self.writeToStorage(
180+
registry: registry,
181+
package: package,
182+
version: version,
183+
checksum: checksum,
184+
contentType: .manifest(toolsVersion),
185+
observabilityScope: observabilityScope,
186+
callbackQueue: callbackQueue
187+
) { writeResult in
188+
completion(writeResult.tryMap { _ in () })
189+
}
190+
}
191+
}
192+
}
193+
194+
// MARK: - storage helpers
195+
133196
private func readFromStorage(
134197
package: PackageIdentity.RegistryIdentity,
135198
version: Version,
199+
contentType: Fingerprint.ContentType,
136200
observabilityScope: ObservabilityScope,
137201
callbackQueue: DispatchQueue,
138202
completion: @escaping (Result<String?, Error>) -> Void
@@ -145,6 +209,7 @@ struct PackageVersionChecksumTOFU {
145209
package: package.underlying,
146210
version: version,
147211
kind: .registry,
212+
contentType: contentType,
148213
observabilityScope: observabilityScope,
149214
callbackQueue: callbackQueue
150215
) { result in
@@ -155,7 +220,9 @@ struct PackageVersionChecksumTOFU {
155220
completion(.success(nil))
156221
case .failure(let error):
157222
observabilityScope
158-
.emit(error: "Failed to get registry fingerprint for \(package) \(version) from storage: \(error)")
223+
.emit(
224+
error: "failed to get registry fingerprint for \(contentType) of \(package) \(version) from storage: \(error)"
225+
)
159226
completion(.failure(error))
160227
}
161228
}
@@ -166,6 +233,7 @@ struct PackageVersionChecksumTOFU {
166233
package: PackageIdentity.RegistryIdentity,
167234
version: Version,
168235
checksum: String,
236+
contentType: Fingerprint.ContentType,
169237
observabilityScope: ObservabilityScope,
170238
callbackQueue: DispatchQueue,
171239
completion: @escaping (Result<Void, Error>) -> Void
@@ -174,10 +242,11 @@ struct PackageVersionChecksumTOFU {
174242
return completion(.success(()))
175243
}
176244

245+
let fingerprint = Fingerprint(origin: .registry(registry.url), value: checksum, contentType: contentType)
177246
fingerprintStorage.put(
178247
package: package.underlying,
179248
version: version,
180-
fingerprint: .init(origin: .registry(registry.url), value: checksum),
249+
fingerprint: fingerprint,
181250
observabilityScope: observabilityScope,
182251
callbackQueue: callbackQueue
183252
) { result in
@@ -191,7 +260,7 @@ struct PackageVersionChecksumTOFU {
191260
case .warn:
192261
observabilityScope
193262
.emit(
194-
warning: "The checksum \(checksum) from \(registry.url.absoluteString) does not match previously recorded value \(existing.value) from \(String(describing: existing.origin.url?.absoluteString))"
263+
warning: "the checksum \(checksum) for \(contentType) of \(package) \(version) from \(registry.url.absoluteString) does not match previously recorded value \(existing.value) from \(String(describing: existing.origin.url?.absoluteString))"
195264
)
196265
completion(.success(()))
197266
}

0 commit comments

Comments
 (0)